The operator coordinates sensitive infrastructure; it does not make every identity trusted. Review who can express intent, who may approve dangerous controls, and which component owns each secret or resource.
Security routes
Assets, actors, boundaries, assumptions, and controls.
Tenant boundariesNamespace introduction, controller authority, user bindings, and cleanup.
Secrets and credentialsGenerated bootstrap material, referenced credentials, retention, and access.
Admission guardrailsRequired policies, protected intent, and fail-closed behavior.
Workload securityPod contexts, token projection, writable paths, and job limits.
Supply chainSignature verification, digest pinning, image credentials, and remaining gaps.
Security profiles
Hardened requires explicit, reviewable production controls. Development permits a smaller evaluation setup and
must not be mistaken for an equivalent security posture. See Choose a security profile
for the enforced contract.
Identity and admission
Creating a cluster does not automatically authorize every high-impact field. Delegated Kubernetes permissions protect publication, custom images, trust roots, cloud identity references, restore controls, and other dangerous choices. See operator authorization for the grant procedure.
Workload and tenant boundaries
The operator uses namespace-scoped delegation, managed-resource provenance, admission policy, security contexts, TLS, and network controls together. No single control substitutes for the rest. Use network policy and service exposure and TLS for the configuration procedures; this section keeps only the security contracts that are not already owned there.